Re: [Qemu-devel] [PATCH 1/1] sandbox: avoid to compile options if CONFIG_SECCOMP undefined

[Eric Blake]

On 05/08/2018 11:40 PM, Yi Min Zhao wrote:

> > If seccomp is disabled, we should really disable the entire -sandbox
> > argument, not merly the options to it.
> I think it would bring a lot of changes if disable the entire -sandbox 
> argument.
> Looking from current code, sandbox is a default qemu option group, and 
> sandbox.enable is false by default unless you obviously define it with 
> true.
> So, this patch is an easier way to fixup.

If the only thing you can do with -sandbox is turn it off (which is its 
default state), it's better to not advertise it at all in the first 
place.  I agree with Daniel that it's better to cripple -sandbox from 
even being usable as a command-line argument if it isn't going to work, 
as that's easier to introspect.

--
Eric Blake, Principal Software Engineer
Red Hat, Inc.           +1-919-301-3266
Virtualization:  qemu.org | libvirt.org